Regardless of whether you use a string representation or a BER/DER representation of a value of a particular syntax, you need to define an LDAPsyntaxes and appropriate matchingRules (and code that implements them) if you want your server to check/match per the syntax. Otherwise, to the server, it's just a BLOB. Kurt